skills.rest
hataiit9x
hataiit9xCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

graphql-audit

Automate security checks for GraphQL APIs to detect vulnerabilities.

3|Updated Jul 6, 2026
Search Tags:#graphql#api security#vulnerability scanning#graphql api#security auditing
One-click install
npx skills add https://github.com/hataiit9x/Bbkit-AI --skill graphql-audit-hataiit9x
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: graphql-audit
Source: https://github.com/hataiit9x/Bbkit-AI/tree/main/ref/claude-bug-bounty/skills/graphql-audit
Command: npx skills add https://github.com/hataiit9x/Bbkit-AI --skill graphql-audit-hataiit9x

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires graphw00f, clairvoyance, graphql-cop, gqlmap, inql, graphql-voyager, wscat, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides automated security auditing for GraphQL APIs, identifying vulnerabilities like IDOR, injection attacks, and schema leaks.

Core Features & Use Cases

  • Automated Security Audits: Full scan for security issues using scripts like graphql_audit.sh.
  • Introspection Checks: Identify if introspection is enabled and if schema details can be extracted.
  • Field Discovery: Enumerate all possible fields in the GraphQL schema using tools like clairvoyance.
  • Batching & Rate Limit Testing: Test for vulnerabilities like batching DoS and unauthorized mutation rate limiting.
  • Use Case: When assessing the security of a GraphQL API and need to automate the discovery of common security issues.

Quick Start

Run the graphql-audit.sh script on the target GraphQL endpoint.

Frequently Asked Questions about graphql-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate GraphQL API security auditing for vulnerabilities like IDOR and injection?▼

To automate GraphQL API security auditing, you can run a script like `graphql_audit.sh` to scan endpoints for vulnerabilities including IDOR, injection attacks, and schema leaks without manual testing overhead.

What is the best way to check if GraphQL introspection and schema leaks are exposed?▼

Checking GraphQL introspection involves scanning the API to determine if introspection is enabled and extracting schema details. This process identifies unauthorized schema leaks and enumerates possible fields using tools like clairvoyance.

Can I test my GraphQL API for batching DoS and rate limiting vulnerabilities?▼

You can test GraphQL APIs for batching DoS and rate limiting vulnerabilities by running specialized security audit scripts that evaluate unauthorized mutation rates and batch query abuse on the target endpoint.

How do I enumerate all possible fields in a GraphQL schema when introspection is disabled?▼

To enumerate GraphQL schema fields when introspection is disabled, the audit process utilizes clairvoyance to discover hidden fields and reconstruct the schema structure through automated field suggestion analysis.

Does this GraphQL vulnerability scanning approach require installing external dependencies?▼

This GraphQL vulnerability scanning approach relies on several dependencies including graphw00f, clairvoyance, graphql-cop, gqlmap, inql, and graphql-voyager to execute its automated security checks and field discovery.

Related Skills

Explore More Software Engineering Skills→
kurtjameshayeskurtjameshayes

api_documentation_analysis

Extract authentication methods, endpoints, and usage patterns from API documentation.

Community
Advanced
MacPhobosMacPhobos

Security Scanning

Automate security scanning of code and dependencies for vulnerabilities.

Community
Intermediate
bpnrockstarbpnrockstar

graphql-audit

Automate GraphQL API security audits for schema exposure and injection vulnerabilities.

Community
Advanced
langbyyilangbyyi
96

API Fuzzing for Bug Bounty

Fuzz REST, SOAP, and GraphQL APIs for vulnerabilities.

Community
Intermediate